CVE-2026-91347 in iSupport
Summary
by MITRE • 10/21/2026
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the iSupport component of Oracle E-Business Suite, specifically affecting versions ranging from 12.2.3 through 12.2.15. This security flaw is classified as a critical integrity and availability issue with a CVSS v3.1 base score of 8.5. The vulnerability allows for exploitation by an attacker who possesses low privileges but has network access via the HTTP protocol. Unlike typical vulnerabilities that are confined to their immediate component, this defect exhibits a scope change characteristic where successful exploitation can significantly impact additional products beyond iSupport itself. This lateral potential amplifies the risk profile, as it suggests that compromising one entry point may lead to broader system instability or data compromise across interconnected modules within the enterprise suite.
From a technical perspective, the flaw enables unauthorized creation, deletion, or modification of critical data and all accessible information within the iSupport environment. The ability to alter such data points directly correlates with high integrity impacts, as it allows an adversary to manipulate business-critical records without proper authorization. Furthermore, the vulnerability facilitates partial denial of service conditions against the iSupport application. This availability impact means that legitimate users may be unable to access support services or related functionalities during periods of exploitation. The combination of data manipulation and service disruption creates a severe operational risk for organizations relying on these systems for customer relationship management and internal support operations.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management due to the requirement for low privileged access combined with network reachability. The ability to modify critical data maps closely to CWE-740 Injection or CWE-352 Cross-Site Request Forgery depending on the specific vector used within the HTTP interface, while the denial of service aspect relates to CWE-400 Uncontrolled Resource Consumption. From a tactical standpoint as defined by MITRE ATT&CK, this vulnerability supports techniques associated with Initial Access via web applications and potentially Persistence or Impact through data manipulation and resource exhaustion. The scope change indicates that attackers may leverage this entry point for lateral movement within the application architecture, making it a significant concern for defense-in-depth strategies.
Mitigation efforts must prioritize immediate patching to the latest supported version of Oracle E-Business Suite as recommended by vendor security advisories. In environments where patching is not immediately feasible, network segmentation should be implemented to restrict HTTP access to the iSupport component from untrusted networks or low-privilege user segments. Web Application Firewalls can be configured with specific rulesets to detect and block anomalous request patterns associated with data modification attempts or resource exhaustion attacks targeting this module. Additionally, organizations should enforce strict input validation and output encoding practices within custom integrations that interact with the iSupport API. Regular auditing of access logs for unusual activity related to service requests is also advised to identify potential exploitation attempts early in the attack lifecycle.